Module 9: Attacking WPS Networks
WPS Technology Details
Just discussing WPS technology, requirements, etc.
WPS Vulnerabilities
PIN verification is done in two parts. The first half is checked, then the second half rather than the entire PIN. First half has 10000 possibilities, second half has 1000. A couple tools were developed to attack this, reaver and bully. PixieWPS takes advantage of the weak random number generator used in a few chipsets, meaning not all WPS implementations are vulnerable.
WPS Attack
Using wash to list out APs with WPS:
kali@kali:~$ wash -i wlan0mon
BSSID Ch dBm WPS Lck Vendor ESSID
--------------------------------------------------------------------------------
00:0A:D0:97:39:6F 1 -88 2.0 No Broadcom linksys
C8:BC:C8:FE:D9:65 2 -28 2.0 No AtherosC secnet
34:08:04:09:3D:38 3 -32 1.0 No RalinkTe wifuWPS version 2 mandated mitigations to prevent brute forcing, which may actually just slow down a brutefroce. Lck indicates if WPS is locked, meaning an attack is pointless.
wash by default scans the 2.4GHz band but can scan 5GHz by using the -5 option. We can also just use airodump-ng to display WPS information using --wps.
Using reaver to attack an AP with WPS:
If vulnerable to the PixieWPS attack, results will be much quicker:
Implementation Variations
Checking the first three bytes of the BSSID against known PINs:
Overcoming Unexpected Errors
WPS Transaction Failure
Could be a temporary failure. Restart reaver without the PixieWPS option.
ACK Issues
The wireless card doesn't acknowledge frames sent by the AP. Use a different wireless card with a different chipset.
WPS Lock
When WPS is locked, a DoS on the AP can be done via mdk3 or mdk4. This will trigger a reboot a reboot which releases the lock.
Last updated